How to build a crypto trading bot on Upbit's Open API: 10 quote requests a second and a 5,000 won minimum order

2026-10-17

Where does building a crypto trading bot usually stall first?

At the exchange's rules. Many projects stop at rules the exchange has already set, well before the trading strategy matters.

A bot only reads prices and places orders through the exchange's Open API. The conditions for getting a key, the addresses that may use it, the requests allowed per second and the price units of an order are all fixed before any code is written.

This post explains those four ideas using only the numbers in the developer docs of Upbit, a Korean exchange. It does not cover strategies or returns.

1.API key: the key that sets what the bot may do

An API key lets a program send requests in the account holder's name. It comes as an access key and a secret key.

Upbit's docs say a key can be issued only after customer verification and two-factor authentication (2FA), and only on the PC website (Upbit API key guide). The main pocket can hold up to 10 keys, and a sub-pocket up to 5.

When issuing, permissions such as viewing assets, placing orders and withdrawing are picked one by one. The docs say a key with withdrawal permission automatically gets a withdrawal-safety block, so that key cannot call the withdrawal API.

The secret key is shown only on the screen where it is issued. If it is lost there is no way to see it again, so the key has to be deleted and a new one issued.

Each request carries a JWT token made with this key, and the docs recommend HS512 signing and a new nonce every time (Upbit auth docs).

2.Allowed IPs: the addresses that may use the key

A key is tied to the IP addresses of the computers that will send requests with it. Each key takes up to 10, they must be public IPv4 addresses, and private IPs are refused.

Upbit does not recommend the API on a dynamic IP. If a home connection's public IP changes, it must be registered again.

For a bot meant to run around the clock, settling on a place with a fixed IP first saves trouble.

3.Request limits: how many calls per second

A rate limit caps how many requests are accepted in a set time. Upbit gives each group of requests its own cap.

These are the numbers in Upbit's rate limit docs.

Quotation: market, candle, trade, ticker and orderbook groups, 10 per second each, counted per IP
General: the default group, asset and order lookups and cancels, 30 per second
New orders: the order group, 12 per second
Order test: the order-test group, 8 per second
Cancel all: the order-cancel-all group, 1 every 2 seconds
WebSocket: 5 connections per second, messages 5 per second and 100 per minute

▲ Per-second request caps by group in Upbit's Open API. Cancel all is 1 every 2 seconds, drawn as 0.5.

Quotation calls are counted per IP and exchange calls per pocket. Two programs on the same home connection share one quotation limit.

A quick count: asking for the current price of 20 coins (an assumed example) one by one every second is 20 calls a second, over the quotation cap of 10. Before building, count how many requests a second the design sends.

Going over the limit returns 429 Too Many Requests. Wait for the next second, the docs say, then send again.

Repeated 429s bring a 418, and the same IP, pocket or connection is blocked for a while. The response states the block time to wait out, and the docs say blocks grow longer if violations continue.

The remaining count is in the Remaining-Req response header. Its sec value is the count left right now, and at 0 that group should get no more calls for a moment. The min value on the same line is no longer used and should be ignored.

The last step before an order can be checked with the order test call. The docs say it does not create an order and only validates the request format and whether the pair can take orders (order test).

4.Order units: tick size and minimum order

The tick size is the smallest step in which an order price can be set. The higher the price range, the bigger the step.

In the KRW market table, prices of 1 million won and up move in 1,000 won steps, 100,000 to 500,000 won in 100 won steps, and 1,000 to 5,000 won in 1 won steps (KRW market order units).

▲ The order of checks from issuing a key to the first order. Numbers are from Upbit's developer docs.

The minimum order amount is 5,000 won. The same page also notes that the tick policy changed on 31 July 2025.

Hard-coding the table can block orders when the policy changes. The order chance call returns each pair's buy and sell fee rates and minimum order amounts (order chance).

▲ Settle the key, the IP and the request count first, then start writing code.

5.Common questions before building

Q.Can it run on a home PC?

A.Only public IPv4 addresses can be registered, and Upbit says it does not recommend dynamic IPs. If the public IP changes, it has to be registered again.

Q.Can orders be checked without real money?

A.The order test call validates the format and whether the pair can take orders without creating an order. It has its own cap of 8 a second.

Q.Does going over the limit lock the account?

A.A 429 comes first, and repeating it brings a 418 that blocks the same IP, pocket or connection for a while. The block grows longer if it keeps happening.

Q.What if the secret key is lost?

A.The secret key can only be seen on the issuing screen. Delete that key and issue a new one.

Fees by bot type are compared in crypto trading bots compared, and key permissions on an overseas exchange are covered in Binance trading bot.

Hiddenpick is a Windows program that keeps on its server the betting rules that pick owners do not make public, and runs them as they are on the PC of the person who received them through a referral code. It currently runs on Evolution live baccarat at Stake (stake.com). What the program does and does not do is in the baccarat bot guide. We are recruiting national pickster representatives, and those selected receive benefits worth $12,000, a one-year pass (apply at hiddenpick.my/pickster).

← Reading